The function "gp_validate_path_len" first tests if the path has a cwd prefix and then reduces the path. In the case of a path like "./../tmp/aa" it will first see that it has a cwd prefix and then reduce it to "../tmp/aa". When validation fails, it tries the variant without the cwd prefix by skipping the first two characters. But this will skip the ".." and validate "/tmp/aa", which is an allowed path (on Linux). References: https://ghostscript.readthedocs.io/en/gs10.03.1/News.html https://bugs.ghostscript.com/show_bug.cgi?id=707691 Upstream commits: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=5ae2e320d69a7d0973011796bd388cd5befa1a43 https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f5336e5b4154f515ac83bc5b9eba94302e6618d4
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:6197 https://access.redhat.com/errata/RHSA-2024:6197
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2024:6466 https://access.redhat.com/errata/RHSA-2024:6466